apiblaze 0.11.0 → 0.12.0

package/dist/index.js

@@ -300,12 +300,199 @@ var init_anon_cred = __esm({
   }
 });
 
+// src/lib/trace.ts
+function setVerbose(v) {
+  verbose = v;
+}
+function recordCall(e) {
+  if (verbose) entries.push(e);
+}
+function maskBody(body) {
+  if (body === void 0) return void 0;
+  return JSON.stringify(body, (k, v) => SECRET_KEY.test(k) && typeof v === "string" ? "***" : v);
+}
+function renderTrace() {
+  if (!verbose || entries.length === 0) return;
+  console.log(import_chalk15.default.dim("\n" + "\u2500".repeat(64)));
+  console.log(import_chalk15.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
+  console.log(
+    import_chalk15.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`).\nFull API reference: https://api.apiblaze.com/openapi.json\n")
+  );
+  entries.forEach((e, i) => {
+    const n = entries.length > 1 ? import_chalk15.default.bold(`${i + 1}. `) : "";
+    if (e.summary) console.log(`${n}${import_chalk15.default.cyan(e.summary)}${e.status ? import_chalk15.default.dim(`  (HTTP ${e.status})`) : ""}`);
+    const url = `https://api.apiblaze.com/${CONTROL_API_VERSION}/prod${e.path}`;
+    const masked = maskBody(e.body);
+    const hasBody = e.method !== "GET" && masked !== void 0;
+    console.log(import_chalk15.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
+    console.log(import_chalk15.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
+    if (hasBody) {
+      console.log(import_chalk15.default.green("    -H 'Content-Type: application/json' \\"));
+      console.log(import_chalk15.default.green(`    -d '${masked}'`));
+    }
+    if (i < entries.length - 1) console.log();
+  });
+  entries.length = 0;
+}
+var import_chalk15, CONTROL_API_VERSION, verbose, entries, SECRET_KEY;
+var init_trace = __esm({
+  "src/lib/trace.ts"() {
+    "use strict";
+    import_chalk15 = __toESM(require("chalk"));
+    CONTROL_API_VERSION = "1.0.0";
+    verbose = false;
+    entries = [];
+    SECRET_KEY = /secret|token|password|api[_-]?key|client_secret/i;
+  }
+});
+
+// src/lib/admin.ts
+async function admin(call) {
+  const token = getAccessToken();
+  const res = await fetch(`${DASHBOARD_BASE3}/api/cli/admin`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify({ path: call.path, method: call.method, body: call.body })
+  });
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+  }
+  recordCall({ method: call.method, path: call.path, body: call.body, status: res.status, summary: call.summary });
+  maybePrintBilling(data);
+  if (!res.ok) {
+    const msg = data?.details ?? data?.error ?? res.statusText;
+    throw new ApiError(res.status, typeof msg === "string" ? msg : JSON.stringify(msg), data);
+  }
+  return data;
+}
+function maybePrintBilling(data) {
+  const b = data?.billing;
+  if (b && typeof b.charged_cents === "number") {
+    const usd = (b.charged_cents / 100).toFixed(2);
+    const rem = typeof b.credits_remaining === "number" ? ` \xB7 $${(b.credits_remaining / 100).toFixed(2)} credit left` : "";
+    console.log(import_chalk16.default.magenta(`  \u{1F4B3} Charged $${usd}${rem}`));
+  }
+}
+var import_chalk16, DASHBOARD_BASE3;
+var init_admin = __esm({
+  "src/lib/admin.ts"() {
+    "use strict";
+    import_chalk16 = __toESM(require("chalk"));
+    init_auth();
+    init_trace();
+    init_types();
+    DASHBOARD_BASE3 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
+  }
+});
+
+// src/lib/tenant-pick.ts
+var tenant_pick_exports = {};
+__export(tenant_pick_exports, {
+  pickTenant: () => pickTenant
+});
+async function fetchPage(teamId, q) {
+  const out = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/tenants?detail=1&limit=${PAGE}${q ? `&q=${encodeURIComponent(q)}` : ""}`,
+    summary: q ? `Search tenants matching "${q}"` : "List tenants (first page)"
+  });
+  const rows = (out?.tenants ?? []).map(
+    (t) => typeof t === "string" ? { tenant_name: t } : t
+  );
+  return { rows, total: out?.total ?? rows.length, defaultTenant: out?.default_tenant ?? null };
+}
+function label(t, defaultTenant, active) {
+  const tags = [
+    t.tenant_name === active ? import_chalk22.default.cyan("active scope") : "",
+    t.tenant_name === defaultTenant ? import_chalk22.default.dim("team default") : ""
+  ].filter(Boolean).join(", ");
+  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk22.default.dim(`  ${t.display_name}`) : "";
+  return `${t.tenant_name}${disp}${tags ? `  (${tags})` : ""}`;
+}
+async function pickTenant(teamId, opts = {}) {
+  const { default: inquirer2 } = await import("inquirer");
+  const active = loadCredentials()?.activeTenant;
+  let q = opts.initialQuery ?? "";
+  for (; ; ) {
+    const spinner = (0, import_ora8.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
+    const page = await fetchPage(teamId, q).finally(() => spinner.stop());
+    if (!page.total && !q) {
+      if (opts.allowCreate) {
+        const { make } = await inquirer2.prompt([{ type: "confirm", name: "make", message: "No tenants yet \u2014 create one?", default: true }]);
+        if (make) return await createTenantInline(teamId);
+      }
+      console.error(import_chalk22.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
+      return null;
+    }
+    const truncated = page.total > page.rows.length;
+    const choices = page.rows.map((t) => ({
+      name: label(t, page.defaultTenant, active),
+      value: t.tenant_name
+    }));
+    if (truncated || q) {
+      choices.push(new inquirer2.Separator(import_chalk22.default.dim(
+        truncated ? `showing ${page.rows.length} of ${page.total}${q ? ` matching "${q}"` : ""} \u2014 search to narrow` : `matches for "${q}"`
+      )));
+      choices.push({ name: `\u{1F50D} Search${q ? " again" : ""}\u2026`, value: "\0search" });
+    }
+    if (q) choices.push({ name: "\u21BA Show all (clear search)", value: "\0clear" });
+    if (opts.allowCreate) choices.push({ name: "\uFF0B Create a new tenant\u2026", value: "\0create" });
+    if (opts.allowBack) choices.push({ name: "\u2190 Back", value: "\0back" });
+    const { picked } = await inquirer2.prompt([{
+      type: "list",
+      name: "picked",
+      pageSize: PAGE + 5,
+      message: opts.message ?? "Which tenant?",
+      default: active && page.rows.some((t) => t.tenant_name === active) ? active : void 0,
+      choices
+    }]);
+    if (picked === "\0back") return null;
+    if (picked === "\0clear") {
+      q = "";
+      continue;
+    }
+    if (picked === "\0create") return await createTenantInline(teamId);
+    if (picked === "\0search") {
+      const { nq } = await inquirer2.prompt([{ type: "input", name: "nq", message: "Search (name or display name):", default: q }]);
+      q = String(nq ?? "").trim();
+      continue;
+    }
+    return picked;
+  }
+}
+async function createTenantInline(teamId) {
+  const { default: inquirer2 } = await import("inquirer");
+  const { display } = await inquirer2.prompt([{ type: "input", name: "display", message: "Display name for the new tenant:", validate: (s) => !!s.trim() || "required" }]);
+  const out = await admin({
+    method: "POST",
+    path: `/teams/${encodeURIComponent(teamId)}/tenants`,
+    body: { display_name: display.trim() },
+    summary: `Create tenant "${display.trim()}"`
+  });
+  const slug = out?.tenant_name ?? out?.tenant?.tenant_name;
+  console.log(import_chalk22.default.green(`  Tenant ${import_chalk22.default.bold(slug)} created.`));
+  return slug;
+}
+var import_chalk22, import_ora8, PAGE;
+var init_tenant_pick = __esm({
+  "src/lib/tenant-pick.ts"() {
+    "use strict";
+    import_chalk22 = __toESM(require("chalk"));
+    import_ora8 = __toESM(require("ora"));
+    init_admin();
+    init_auth();
+    PAGE = 15;
+  }
+});
+
 // src/index.ts
 var import_commander = require("commander");
-var import_chalk32 = __toESM(require("chalk"));
+var import_chalk34 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.11.0";
+var version = "0.12.0";
 
 // src/index.ts
 init_types();
@@ -1009,9 +1196,9 @@ function printTunnelEndpoints(restore, targets) {
   if (restore.length === 0) return;
   console.log(import_chalk4.default.bold("\nYour proxy is live at:"));
   for (const r of restore) {
-    const label = targets.find((t) => t.projectId === r.projectId)?.projectName ?? r.projectId;
+    const label2 = targets.find((t) => t.projectId === r.projectId)?.projectName ?? r.projectId;
     console.log(`
-  ${import_chalk4.default.bold(label)}`);
+  ${import_chalk4.default.bold(label2)}`);
     const internalEnvs = Object.keys(r.environments ?? {}).filter((e) => isInternalTarget(r.environments[e]?.target));
     const envs = internalEnvs.includes("dev") ? ["dev"] : internalEnvs.length ? internalEnvs : ["dev"];
     for (const env of envs) {
@@ -1835,6 +2022,7 @@ async function runWhoami(opts = {}) {
     console.log(`  ${import_chalk9.default.cyan("Signed in as")} ${import_chalk9.default.bold(who)}`);
     if (creds.email && creds.email !== who) console.log(`  Email:   ${creds.email}`);
     if (creds.teamName || creds.teamId) console.log(`  Team:    ${import_chalk9.default.bold(creds.teamName ?? creds.teamId)}`);
+    if (creds.activeTenant) console.log(`  Tenant scope: ${import_chalk9.default.bold(creds.activeTenant)}  ${import_chalk9.default.dim("(clear: `apiblaze tenant use --clear`)")}`);
     if (Date.now() >= creds.expiresAt) console.log(import_chalk9.default.yellow("  \u26A0 Session expired \u2014 run `apiblaze login`."));
   }
   console.log(import_chalk9.default.bold("\nAPI Consumer"));
@@ -2181,82 +2369,7 @@ async function runMcp(projectArg, apiVersionArg, opts) {
 // src/commands/delete.ts
 var import_chalk18 = __toESM(require("chalk"));
 var import_ora5 = __toESM(require("ora"));
-
-// src/lib/admin.ts
-var import_chalk16 = __toESM(require("chalk"));
-init_auth();
-
-// src/lib/trace.ts
-var import_chalk15 = __toESM(require("chalk"));
-var CONTROL_API_VERSION = "1.0.0";
-var verbose = false;
-var entries = [];
-function setVerbose(v) {
-  verbose = v;
-}
-function recordCall(e) {
-  if (verbose) entries.push(e);
-}
-var SECRET_KEY = /secret|token|password|api[_-]?key|client_secret/i;
-function maskBody(body) {
-  if (body === void 0) return void 0;
-  return JSON.stringify(body, (k, v) => SECRET_KEY.test(k) && typeof v === "string" ? "***" : v);
-}
-function renderTrace() {
-  if (!verbose || entries.length === 0) return;
-  console.log(import_chalk15.default.dim("\n" + "\u2500".repeat(64)));
-  console.log(import_chalk15.default.bold(`--verbose: ${entries.length} API call${entries.length === 1 ? "" : "s"} this command made`));
-  console.log(
-    import_chalk15.default.dim("The same thing on the official API \u2014 copy/paste with your control-plane key\n(get one from the Developers section of dashboard.apiblaze.com, then\n`export APIBLAZE_CONTROLPLANE_APIKEY=sk_...`).\nFull API reference: https://api.apiblaze.com/openapi.json\n")
-  );
-  entries.forEach((e, i) => {
-    const n = entries.length > 1 ? import_chalk15.default.bold(`${i + 1}. `) : "";
-    if (e.summary) console.log(`${n}${import_chalk15.default.cyan(e.summary)}${e.status ? import_chalk15.default.dim(`  (HTTP ${e.status})`) : ""}`);
-    const url = `https://api.apiblaze.com/${CONTROL_API_VERSION}/prod${e.path}`;
-    const masked = maskBody(e.body);
-    const hasBody = e.method !== "GET" && masked !== void 0;
-    console.log(import_chalk15.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
-    console.log(import_chalk15.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
-    if (hasBody) {
-      console.log(import_chalk15.default.green("    -H 'Content-Type: application/json' \\"));
-      console.log(import_chalk15.default.green(`    -d '${masked}'`));
-    }
-    if (i < entries.length - 1) console.log();
-  });
-  entries.length = 0;
-}
-
-// src/lib/admin.ts
-init_types();
-var DASHBOARD_BASE3 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
-async function admin(call) {
-  const token = getAccessToken();
-  const res = await fetch(`${DASHBOARD_BASE3}/api/cli/admin`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ path: call.path, method: call.method, body: call.body })
-  });
-  let data = null;
-  try {
-    data = await res.json();
-  } catch {
-  }
-  recordCall({ method: call.method, path: call.path, body: call.body, status: res.status, summary: call.summary });
-  maybePrintBilling(data);
-  if (!res.ok) {
-    const msg = data?.details ?? data?.error ?? res.statusText;
-    throw new ApiError(res.status, typeof msg === "string" ? msg : JSON.stringify(msg), data);
-  }
-  return data;
-}
-function maybePrintBilling(data) {
-  const b = data?.billing;
-  if (b && typeof b.charged_cents === "number") {
-    const usd = (b.charged_cents / 100).toFixed(2);
-    const rem = typeof b.credits_remaining === "number" ? ` \xB7 $${(b.credits_remaining / 100).toFixed(2)} credit left` : "";
-    console.log(import_chalk16.default.magenta(`  \u{1F4B3} Charged $${usd}${rem}`));
-  }
-}
+init_admin();
 
 // src/lib/resolve.ts
 var import_chalk17 = __toESM(require("chalk"));
@@ -2369,6 +2482,7 @@ async function runDelete(project, version2, opts) {
 // src/commands/export.ts
 var import_chalk19 = __toESM(require("chalk"));
 var import_fs3 = require("fs");
+init_admin();
 init_auth();
 var DASHBOARD_BASE4 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
 async function runExport(projectArg, versionArg, opts) {
@@ -2425,6 +2539,7 @@ async function runExport(projectArg, versionArg, opts) {
 // src/commands/config.ts
 var import_chalk20 = __toESM(require("chalk"));
 var import_ora6 = __toESM(require("ora"));
+init_admin();
 async function patchConfig(project, opts, body, summary) {
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
@@ -2478,13 +2593,15 @@ async function runRename(project, opts) {
 }
 
 // src/commands/config-browse.ts
-var import_chalk26 = __toESM(require("chalk"));
-var import_ora11 = __toESM(require("ora"));
+var import_chalk28 = __toESM(require("chalk"));
+var import_ora13 = __toESM(require("ora"));
+init_admin();
 init_auth();
 
 // src/commands/domain.ts
 var import_chalk21 = __toESM(require("chalk"));
 var import_ora7 = __toESM(require("ora"));
+init_admin();
 async function runDomainAdd(project, opts) {
   if (!opts.domain) {
     console.error(import_chalk21.default.red("--domain is required."));
@@ -2587,8 +2704,29 @@ async function runDomainSetBase(project, opts) {
 }
 
 // src/commands/tenant.ts
-var import_chalk22 = __toESM(require("chalk"));
-var import_ora8 = __toESM(require("ora"));
+var import_chalk23 = __toESM(require("chalk"));
+var import_ora9 = __toESM(require("ora"));
+init_admin();
+init_auth();
+init_tenant_pick();
+async function runTenantUse(query, opts) {
+  const creds = loadCredentials();
+  if (!creds) {
+    console.error(import_chalk23.default.red("Not logged in. Run `apiblaze login` first."));
+    process.exit(1);
+  }
+  if (opts.clear) {
+    delete creds.activeTenant;
+    saveCredentials(creds);
+    console.log(import_chalk23.default.green("Tenant scope cleared."));
+    return;
+  }
+  const { teamId } = await resolveTeam(opts.team);
+  const slug = await pickTenant(teamId, { message: "Scope future commands to which tenant?", initialQuery: query });
+  if (!slug) process.exit(1);
+  saveCredentials({ ...creds, activeTenant: slug });
+  console.log(import_chalk23.default.green(`Tenant scope set to ${import_chalk23.default.bold(slug)}.`) + import_chalk23.default.dim("  (clear with `apiblaze tenant use --clear`)"));
+}
 async function runTenantList(opts) {
   const { teamId, teamName } = await resolveTeam(opts.team);
   const out = await admin({
@@ -2602,22 +2740,22 @@ async function runTenantList(opts) {
     return;
   }
   if (!tenants.length) {
-    console.log(import_chalk22.default.yellow("No tenants."));
+    console.log(import_chalk23.default.yellow("No tenants."));
     return;
   }
   for (const t of tenants) {
     const name = typeof t === "string" ? t : t.tenant_name;
-    const display = typeof t === "string" ? "" : import_chalk22.default.dim(`  ${t.display_name ?? ""}`);
-    console.log(`  ${import_chalk22.default.bold(name)}${display}`);
+    const display = typeof t === "string" ? "" : import_chalk23.default.dim(`  ${t.display_name ?? ""}`);
+    console.log(`  ${import_chalk23.default.bold(name)}${display}`);
   }
 }
 async function runTenantCreate(opts) {
   if (!opts.name) {
-    console.error(import_chalk22.default.red("--name (display name) is required."));
+    console.error(import_chalk23.default.red("--name (display name) is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora8.default)("Creating tenant...").start();
+  const spinner = (0, import_ora9.default)("Creating tenant...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -2625,7 +2763,7 @@ async function runTenantCreate(opts) {
       body: { display_name: opts.name, ...opts.slug ? { tenant_name: opts.slug } : {} },
       summary: `Create tenant "${opts.name}"`
     });
-    spinner.succeed(`Created tenant ${import_chalk22.default.bold(out?.tenant_name ?? opts.name)}.`);
+    spinner.succeed(`Created tenant ${import_chalk23.default.bold(out?.tenant_name ?? opts.name)}.`);
     if (opts.json) console.log(JSON.stringify(out));
   } catch (err) {
     spinner.fail("Tenant create failed.");
@@ -2634,12 +2772,12 @@ async function runTenantCreate(opts) {
 }
 async function runTenantAttach(project, opts) {
   if (!opts.tenant) {
-    console.error(import_chalk22.default.red("--tenant <slug> is required."));
+    console.error(import_chalk23.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora8.default)("Attaching tenant...").start();
+  const spinner = (0, import_ora9.default)("Attaching tenant...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -2662,11 +2800,11 @@ async function runTenantDelete(slug, opts) {
       { type: "confirm", name: "confirm", message: `Permanently delete tenant "${slug}" and everything under it? This cannot be undone.`, default: false }
     ]);
     if (!confirm) {
-      console.log(import_chalk22.default.dim("Aborted."));
+      console.log(import_chalk23.default.dim("Aborted."));
       return;
     }
   }
-  const spinner = (0, import_ora8.default)("Deleting tenant...").start();
+  const spinner = (0, import_ora9.default)("Deleting tenant...").start();
   try {
     await admin({
       method: "DELETE",
@@ -2681,13 +2819,13 @@ async function runTenantDelete(slug, opts) {
 }
 async function runTenantCors(opts) {
   if (!opts.tenant) {
-    console.error(import_chalk22.default.red("--tenant <slug> is required."));
+    console.error(import_chalk23.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const origins = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
   const cors = origins.length ? { allowed_origins: origins } : null;
-  const spinner = (0, import_ora8.default)("Updating CORS...").start();
+  const spinner = (0, import_ora9.default)("Updating CORS...").start();
   try {
     await admin({
       method: "PUT",
@@ -2702,10 +2840,458 @@ async function runTenantCors(opts) {
   }
 }
 
+// src/commands/tenant-drill.ts
+var import_chalk24 = __toESM(require("chalk"));
+var import_ora10 = __toESM(require("ora"));
+var import_crypto = require("crypto");
+init_admin();
+init_auth();
+init_tenant_pick();
+init_api();
+var trailingComma = /\s*,\s*/;
+var parseList = (s) => s.split(trailingComma).map((x) => x.trim()).filter(Boolean);
+async function runTenantManage(query, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  const slug = opts.tenant ?? loadCredentialsTenant(query) ?? await pickTenant(teamId, { message: "Manage which tenant?", initialQuery: query, allowCreate: true });
+  if (!slug) return;
+  await tenantHome(teamId, slug);
+}
+function loadCredentialsTenant(query) {
+  if (query) return void 0;
+  return loadCredentials()?.activeTenant ?? void 0;
+}
+async function tenantHome(teamId, tenant2) {
+  const { default: inquirer2 } = await import("inquirer");
+  const base = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}`;
+  console.log(import_chalk24.default.bold(`
+Tenant ${tenant2}`));
+  console.log(import_chalk24.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
+  for (; ; ) {
+    const spinner = (0, import_ora10.default)("Reading tenant state...").start();
+    const [iam, cors, emails, issuers, opaque, clients] = await Promise.all([
+      admin({ method: "GET", path: `${base}/iam`, summary: "Read IAM toggle" }).catch(() => null),
+      admin({ method: "GET", path: `${base}/cors`, summary: "Read tenant CORS" }).catch(() => null),
+      admin({ method: "GET", path: `${base}/admin-emails`, summary: "List consumer-admin emails" }).catch(() => null),
+      admin({ method: "GET", path: `${base}/external-issuers`, summary: "List external issuers" }).catch(() => null),
+      admin({ method: "GET", path: `${base}/opaque`, summary: "Read opaque validator" }).catch(() => null),
+      admin({ method: "GET", path: `${base}/app-clients`, summary: "List app clients" }).catch(() => [])
+    ]).finally(() => spinner.stop());
+    const nEmails = (emails?.admin_emails ?? []).length;
+    const nIssuers = (issuers?.external_issuers ?? []).length;
+    const nClients = Array.isArray(clients) ? clients.length : 0;
+    const onOff = (b) => b ? import_chalk24.default.green("on") : import_chalk24.default.dim("off");
+    const { pick: pick2 } = await inquirer2.prompt([{
+      type: "list",
+      name: "pick",
+      message: `Tenant ${tenant2}:`,
+      pageSize: 12,
+      choices: [
+        { name: `App clients (${nClients})  ${import_chalk24.default.dim("OAuth clients your consumers log in through \u2014 providers live inside")}`, value: "clients" },
+        { name: `IAM enforcement: ${onOff(iam?.iam_enabled)}  ${import_chalk24.default.dim("key/identity enforcement for this tenant")}`, value: "iam" },
+        { name: `CORS override: ${cors?.cors ? import_chalk24.default.cyan(JSON.stringify(cors.cors)) : import_chalk24.default.dim("(unset)")}`, value: "cors" },
+        { name: `Consumer-admin emails (${nEmails})  ${import_chalk24.default.dim("who may administer the tenant portal")}`, value: "emails" },
+        { name: `External JWT issuers (${nIssuers})  ${import_chalk24.default.dim("bring-your-own auth: trust tokens you already mint")}`, value: "issuers" },
+        { name: `Opaque-token validator: ${opaque?.opaque?.endpoint ? import_chalk24.default.cyan(opaque.opaque.endpoint) : import_chalk24.default.dim("(unset)")}`, value: "opaque" },
+        { name: "\u2190 Back", value: "back" }
+      ]
+    }]);
+    switch (pick2) {
+      case "back":
+        return;
+      case "clients":
+        await clientsMenu(teamId, tenant2, base);
+        break;
+      case "iam": {
+        const { v } = await inquirer2.prompt([{ type: "confirm", name: "v", message: "Enable IAM enforcement?", default: !!iam?.iam_enabled }]);
+        await admin({ method: "PATCH", path: `${base}/iam`, body: { enabled: v }, summary: `IAM enforcement \u2192 ${v ? "on" : "off"}` });
+        console.log(import_chalk24.default.green(`  IAM enforcement ${v ? "enabled" : "disabled"}.`));
+        break;
+      }
+      case "cors": {
+        const { v } = await inquirer2.prompt([{
+          type: "input",
+          name: "v",
+          message: 'CORS JSON (e.g. {"allow_all_origins":true} \u2014 "null" clears):',
+          default: cors?.cors ? JSON.stringify(cors.cors) : ""
+        }]);
+        if (v === "") break;
+        const parsed = v === "null" ? null : safeJson(v);
+        if (parsed === void 0) {
+          console.log(import_chalk24.default.yellow("  Not valid JSON \u2014 unchanged."));
+          break;
+        }
+        await admin({ method: "PUT", path: `${base}/cors`, body: { cors: parsed }, summary: "Set tenant CORS" });
+        console.log(import_chalk24.default.green("  CORS updated."));
+        break;
+      }
+      case "emails":
+        await emailsMenu(base, emails?.admin_emails ?? []);
+        break;
+      case "issuers":
+        await issuersMenu(base, issuers?.external_issuers ?? []);
+        break;
+      case "opaque": {
+        const cur = opaque?.opaque;
+        const { mode } = await inquirer2.prompt([{
+          type: "list",
+          name: "mode",
+          message: "Opaque-token validator:",
+          choices: [
+            { name: cur ? "Replace it" : "Set one up", value: "set" },
+            ...cur ? [{ name: "Clear it", value: "clear" }] : [],
+            { name: "\u2190 Back", value: "back" }
+          ]
+        }]);
+        if (mode === "back") break;
+        if (mode === "clear") {
+          await admin({ method: "PUT", path: `${base}/opaque`, body: { opaque: null }, summary: "Clear opaque validator" });
+          console.log(import_chalk24.default.green("  Cleared."));
+          break;
+        }
+        const a = await inquirer2.prompt([
+          { type: "input", name: "endpoint", message: "Introspection endpoint (https):", default: cur?.endpoint, validate: (s) => s.startsWith("https://") || "must be https" },
+          { type: "list", name: "method", message: "HTTP method:", choices: ["GET", "POST"], default: cur?.method ?? "GET" }
+        ]);
+        await admin({ method: "PUT", path: `${base}/opaque`, body: { opaque: { endpoint: a.endpoint, method: a.method } }, summary: "Set opaque validator" });
+        console.log(import_chalk24.default.green("  Opaque validator set."));
+        break;
+      }
+    }
+  }
+}
+function safeJson(s) {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return void 0;
+  }
+}
+async function emailsMenu(base, emails) {
+  const { default: inquirer2 } = await import("inquirer");
+  console.log();
+  if (!emails.length) console.log(import_chalk24.default.dim("  No consumer-admin emails."));
+  for (const e of emails) console.log(`  ${import_chalk24.default.bold(e.email ?? e)}  ${import_chalk24.default.dim(e.status ?? "")}`);
+  const { act } = await inquirer2.prompt([{
+    type: "list",
+    name: "act",
+    message: "Consumer-admin emails:",
+    choices: [
+      { name: "Add an email", value: "add" },
+      ...emails.length ? [{ name: "Remove an email", value: "rm" }] : [],
+      { name: "\u2190 Back", value: "back" }
+    ]
+  }]);
+  if (act === "back") return;
+  if (act === "add") {
+    const { email } = await inquirer2.prompt([{ type: "input", name: "email", message: "Email:", validate: (s) => /.+@.+\..+/.test(s) || "not an email" }]);
+    await admin({ method: "POST", path: `${base}/admin-emails`, body: { email }, summary: `Add consumer-admin ${email}` });
+    console.log(import_chalk24.default.green(`  ${email} added.`));
+  } else {
+    const { e } = await inquirer2.prompt([{
+      type: "list",
+      name: "e",
+      message: "Remove which?",
+      choices: [...emails.map((x) => ({ name: x.email ?? String(x), value: x.email ?? String(x) })), { name: "\u2190 Back", value: null }]
+    }]);
+    if (!e) return;
+    await admin({ method: "DELETE", path: `${base}/admin-emails/${encodeURIComponent(e)}`, summary: `Remove consumer-admin ${e}` });
+    console.log(import_chalk24.default.green(`  ${e} removed.`));
+  }
+}
+async function issuersMenu(base, issuers) {
+  const { default: inquirer2 } = await import("inquirer");
+  console.log();
+  if (!issuers.length) console.log(import_chalk24.default.dim("  No external issuers \u2014 consumers use APIblaze-issued tokens."));
+  for (const i of issuers) console.log(`  ${import_chalk24.default.bold(i.iss)}  aud=${i.aud}  ${import_chalk24.default.dim(i.sub_semantics ?? "")}`);
+  const { act } = await inquirer2.prompt([{
+    type: "list",
+    name: "act",
+    message: "External JWT issuers:",
+    choices: [
+      { name: "Add / replace one issuer", value: "add" },
+      ...issuers.length ? [{ name: "Delete an issuer", value: "rm" }] : [],
+      { name: "\u2190 Back", value: "back" }
+    ]
+  }]);
+  if (act === "back") return;
+  if (act === "add") {
+    const a = await inquirer2.prompt([
+      { type: "input", name: "iss", message: "Issuer URL (iss):", validate: (s) => !!s.trim() || "required" },
+      { type: "input", name: "aud", message: "Audience (aud):", validate: (s) => !!s.trim() || "required" },
+      { type: "input", name: "jwks", message: "JWKS URL (empty = derive from issuer):" },
+      { type: "list", name: "sem", message: "Where is the end-user id?", choices: [
+        { name: "The token sub IS the end user (tenant-owned)", value: "tenant_owned" },
+        { name: "Extract it from a claim\u2026", value: "extract_from_claim" }
+      ] }
+    ]);
+    const claim = a.sem === "extract_from_claim" ? (await inquirer2.prompt([{ type: "input", name: "c", message: "Claim name:", validate: (s) => !!s.trim() || "required" }])).c : void 0;
+    await admin({
+      method: "POST",
+      path: `${base}/external-issuers`,
+      body: { iss: a.iss.trim(), aud: a.aud.trim(), jwks_url: a.jwks.trim() || null, sub_semantics: a.sem, ...claim ? { claim_name: claim } : {} },
+      summary: `Add external issuer ${a.iss.trim()}`
+    });
+    console.log(import_chalk24.default.green("  Issuer saved."));
+  } else {
+    const { i } = await inquirer2.prompt([{
+      type: "list",
+      name: "i",
+      message: "Delete which issuer?",
+      choices: [...issuers.map((x) => ({ name: `${x.iss} (aud=${x.aud})`, value: x })), { name: "\u2190 Back", value: null }]
+    }]);
+    if (!i) return;
+    await admin({
+      method: "DELETE",
+      path: `${base}/external-issuers?iss=${encodeURIComponent(i.iss)}&aud=${encodeURIComponent(i.aud)}`,
+      summary: `Delete issuer ${i.iss}`
+    });
+    console.log(import_chalk24.default.green("  Issuer deleted."));
+  }
+}
+async function clientsMenu(teamId, tenant2, base) {
+  const { default: inquirer2 } = await import("inquirer");
+  for (; ; ) {
+    const spinner = (0, import_ora10.default)("Loading app clients...").start();
+    const raw = await admin({ method: "GET", path: `${base}/app-clients`, summary: "List app clients" }).catch(() => []);
+    spinner.stop();
+    const clients = Array.isArray(raw) ? raw : [];
+    const { pick: pick2 } = await inquirer2.prompt([{
+      type: "list",
+      name: "pick",
+      message: `App clients of ${tenant2}:`,
+      pageSize: 15,
+      choices: [
+        ...clients.map((c) => ({
+          name: `${import_chalk24.default.bold(c.name ?? c.clientId)}  ${import_chalk24.default.dim(`${c.clientId}${c.projectName ? ` \xB7 ${c.projectName}` : ""}`)}`,
+          value: c
+        })),
+        ...clients.length ? [] : [new inquirer2.Separator(import_chalk24.default.dim("  no app clients yet"))],
+        { name: "\uFF0B Create an app client\u2026", value: " create" },
+        { name: "\u2190 Back", value: " back" }
+      ]
+    }]);
+    if (pick2 === " back") return;
+    if (pick2 === " create") {
+      const projects = await getProjects(teamId).catch(() => []);
+      if (!projects.length) {
+        console.log(import_chalk24.default.yellow("  No projects in this team \u2014 create a proxy first."));
+        continue;
+      }
+      const a = await inquirer2.prompt([
+        { type: "input", name: "name", message: "Client name:", validate: (s) => !!s.trim() || "required" },
+        { type: "list", name: "proj", message: "For which project?", choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk24.default.dim("v" + p.apiVersion)}`, value: p })) },
+        { type: "input", name: "callbacks", message: "Callback URLs (comma-separated, empty = none):" }
+      ]);
+      const created = await admin({
+        method: "POST",
+        path: `${base}/app-clients`,
+        body: {
+          name: a.name.trim(),
+          projectName: a.proj.projectName,
+          apiVersion: a.proj.apiVersion,
+          ...a.callbacks.trim() ? { authorizedCallbackUrls: parseList(a.callbacks) } : {}
+        },
+        summary: `Create app client "${a.name.trim()}"`
+      });
+      console.log(import_chalk24.default.green(`  App client created${created?.clientId ? ` (${created.clientId})` : ""}.`));
+      continue;
+    }
+    await clientHome(base, pick2);
+  }
+}
+async function clientHome(base, summary) {
+  const { default: inquirer2 } = await import("inquirer");
+  const id = summary.clientId ?? summary.client_id;
+  const cBase = `${base}/app-clients/${encodeURIComponent(id)}`;
+  for (; ; ) {
+    const spinner = (0, import_ora10.default)("Reading app client...").start();
+    const c = await admin({ method: "GET", path: cBase, summary: `Read app client ${id}` }).catch(() => summary);
+    spinner.stop();
+    const cb = c.authorizedCallbackUrls ?? c.authorized_callback_urls ?? [];
+    const scopes = c.scopes ?? [];
+    const nProviders = (c.providers ?? []).length;
+    const { pick: pick2 } = await inquirer2.prompt([{
+      type: "list",
+      name: "pick",
+      message: `${c.name ?? id}:`,
+      pageSize: 12,
+      choices: [
+        { name: `Login providers${nProviders ? ` (${nProviders})` : ""}  ${import_chalk24.default.dim("google/github/microsoft/\u2026 \u2014 how consumers sign in")}`, value: "providers" },
+        { name: `Callback URLs: ${cb.length ? import_chalk24.default.cyan(cb.join(", ")) : import_chalk24.default.dim("(none)")}`, value: "callbacks" },
+        { name: `Scopes: ${scopes.length ? import_chalk24.default.cyan(scopes.join(" ")) : import_chalk24.default.dim("(defaults)")}`, value: "scopes" },
+        { name: `Token expiries: access ${c.accessTokenExpiry ?? 3600}s \xB7 id ${c.idTokenExpiry ?? 3600}s \xB7 refresh ${c.refreshTokenExpiry ?? 2592e3}s`, value: "expiries" },
+        { name: "Reveal client secret", value: "secret" },
+        { name: "Rotate client secret", value: "rotate" },
+        { name: import_chalk24.default.red("Delete this app client"), value: "delete" },
+        { name: "\u2190 Back", value: "back" }
+      ]
+    }]);
+    switch (pick2) {
+      case "back":
+        return;
+      case "providers":
+        await providersMenu(cBase, c.name ?? id);
+        break;
+      case "callbacks": {
+        const { v } = await inquirer2.prompt([{ type: "input", name: "v", message: "Callback URLs (comma-separated):", default: cb.join(", ") }]);
+        await admin({ method: "PATCH", path: cBase, body: { authorizedCallbackUrls: parseList(v) }, summary: "Update callback URLs" });
+        console.log(import_chalk24.default.green("  Callbacks updated."));
+        break;
+      }
+      case "scopes": {
+        const { v } = await inquirer2.prompt([{ type: "input", name: "v", message: "Scopes (space/comma-separated):", default: scopes.join(" ") }]);
+        await admin({ method: "PATCH", path: cBase, body: { scopes: v.split(/[\s,]+/).filter(Boolean) }, summary: "Update scopes" });
+        console.log(import_chalk24.default.green("  Scopes updated."));
+        break;
+      }
+      case "expiries": {
+        const a = await inquirer2.prompt([
+          { type: "input", name: "access", message: "Access token expiry (seconds):", default: String(c.accessTokenExpiry ?? 3600) },
+          { type: "input", name: "id", message: "ID token expiry (seconds):", default: String(c.idTokenExpiry ?? 3600) },
+          { type: "input", name: "refresh", message: "Refresh token expiry (seconds):", default: String(c.refreshTokenExpiry ?? 2592e3) }
+        ]);
+        await admin({
+          method: "PATCH",
+          path: cBase,
+          body: { accessTokenExpiry: Number(a.access), idTokenExpiry: Number(a.id), refreshTokenExpiry: Number(a.refresh) },
+          summary: "Update token expiries"
+        });
+        console.log(import_chalk24.default.green("  Expiries updated."));
+        break;
+      }
+      case "secret": {
+        const { sure } = await inquirer2.prompt([{ type: "confirm", name: "sure", message: "Print the client secret to this terminal?", default: false }]);
+        if (!sure) break;
+        const s = await admin({ method: "GET", path: `${cBase}/secret`, summary: "Reveal client secret" });
+        console.log(`  ${import_chalk24.default.bold("client_secret")}: ${import_chalk24.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
+        break;
+      }
+      case "rotate": {
+        const { sure } = await inquirer2.prompt([{ type: "confirm", name: "sure", message: "Rotate the secret? Existing integrations using it will break.", default: false }]);
+        if (!sure) break;
+        const fresh = randomSecret();
+        await admin({ method: "PATCH", path: cBase, body: { clientSecret: fresh }, summary: "Rotate client secret" });
+        console.log(`  New ${import_chalk24.default.bold("client_secret")}: ${import_chalk24.default.green(fresh)}  ${import_chalk24.default.dim("(store it now)")}`);
+        break;
+      }
+      case "delete": {
+        const { sure } = await inquirer2.prompt([{ type: "confirm", name: "sure", message: `Delete app client "${c.name ?? id}"? Consumers logged in through it will lose access.`, default: false }]);
+        if (!sure) break;
+        await admin({ method: "DELETE", path: cBase, summary: `Delete app client ${id}` });
+        console.log(import_chalk24.default.green("  App client deleted."));
+        return;
+      }
+    }
+  }
+}
+function randomSecret() {
+  const bytes = new Uint8Array(24);
+  (0, import_crypto.randomFillSync)(bytes);
+  return Buffer.from(bytes).toString("base64url");
+}
+var PROVIDER_TYPES = ["google", "github", "microsoft", "facebook", "auth0", "other"];
+var DEFAULT_SCOPES = {
+  google: "openid email profile",
+  microsoft: "openid email profile",
+  github: "read:user user:email",
+  facebook: "public_profile email"
+};
+async function providersMenu(cBase, clientLabel) {
+  const { default: inquirer2 } = await import("inquirer");
+  for (; ; ) {
+    const spinner = (0, import_ora10.default)("Loading providers...").start();
+    const raw = await admin({ method: "GET", path: `${cBase}/providers`, summary: "List login providers" }).catch(() => []);
+    spinner.stop();
+    const providers = Array.isArray(raw) ? raw : [];
+    console.log();
+    for (const p of providers) {
+      console.log(`  ${import_chalk24.default.bold(p.type)}  ${import_chalk24.default.dim(`${p.clientId || "(managed)"} \xB7 identity=${p.tokenType ?? "apiblaze"} \xB7 to-upstream=${p.targetServerToken ?? "apiblaze"}${p.isApiblazeDefault ? " \xB7 apiblaze-managed" : ""}`)}`);
+    }
+    if (!providers.length) console.log(import_chalk24.default.dim("  No login providers \u2014 consumers cannot sign in to this client yet."));
+    const { act } = await inquirer2.prompt([{
+      type: "list",
+      name: "act",
+      message: `Login providers of ${clientLabel}:`,
+      choices: [
+        { name: "\uFF0B Add a provider", value: "add" },
+        ...providers.length ? [
+          { name: "Reveal a provider secret", value: "secret" },
+          { name: "Remove a provider", value: "rm" }
+        ] : [],
+        { name: "\u2190 Back", value: "back" }
+      ]
+    }]);
+    if (act === "back") return;
+    if (act === "add") {
+      const { type } = await inquirer2.prompt([{ type: "list", name: "type", message: "Provider:", choices: PROVIDER_TYPES }]);
+      let body;
+      if (type === "github") {
+        const { managed } = await inquirer2.prompt([{
+          type: "confirm",
+          name: "managed",
+          default: true,
+          message: "Use the APIblaze-managed GitHub app (no credentials needed)?"
+        }]);
+        if (managed) body = { type, managed: true };
+      }
+      if (!body) {
+        const a = await inquirer2.prompt([
+          { type: "input", name: "clientId", message: `${type} OAuth client id:`, validate: (s) => !!s.trim() || "required" },
+          { type: "password", name: "clientSecret", mask: "*", message: `${type} OAuth client secret:`, validate: (s) => s.length >= 6 && s.length <= 200 || "6\u2013200 chars" },
+          ...type === "auth0" || type === "other" ? [{ type: "input", name: "domain", message: "Issuer / domain (e.g. your-tenant.auth0.com):" }] : [],
+          { type: "input", name: "scopes", message: "Scopes:", default: DEFAULT_SCOPES[type] ?? "" }
+        ]);
+        body = {
+          type,
+          clientId: a.clientId.trim(),
+          clientSecret: a.clientSecret,
+          ...a.domain?.trim() ? { domain: a.domain.trim() } : {},
+          scopes: String(a.scopes).split(/[\s,]+/).filter(Boolean)
+        };
+      }
+      const { routing } = await inquirer2.prompt([{
+        type: "list",
+        name: "routing",
+        message: "What does your upstream receive?",
+        choices: [
+          { name: "APIblaze token (recommended \u2014 provider stays an identity source)", value: null },
+          { name: `The ${type} access token`, value: "third_party_access_token" },
+          { name: `The ${type} id token`, value: "third_party_id_token" },
+          { name: "Nothing (strip auth)", value: "none" }
+        ]
+      }]);
+      if (routing) {
+        body.tokenType = "thirdParty";
+        body.targetServerToken = routing;
+      }
+      await admin({ method: "POST", path: `${cBase}/providers`, body, summary: `Add ${type} login provider` });
+      console.log(import_chalk24.default.green(`  ${type} provider added.`));
+    } else {
+      const { p } = await inquirer2.prompt([{
+        type: "list",
+        name: "p",
+        message: act === "rm" ? "Remove which provider?" : "Reveal which secret?",
+        choices: [...providers.map((x) => ({ name: `${x.type} ${import_chalk24.default.dim(x.clientId || "(managed)")}`, value: x })), { name: "\u2190 Back", value: null }]
+      }]);
+      if (!p) continue;
+      if (act === "rm") {
+        const { sure } = await inquirer2.prompt([{ type: "confirm", name: "sure", message: `Remove the ${p.type} provider? Consumers using it can no longer sign in.`, default: false }]);
+        if (!sure) continue;
+        await admin({ method: "DELETE", path: `${cBase}/providers/${encodeURIComponent(p.id)}`, summary: `Remove ${p.type} provider` });
+        console.log(import_chalk24.default.green(`  ${p.type} removed.`));
+      } else {
+        const s = await admin({ method: "GET", path: `${cBase}/providers/${encodeURIComponent(p.id)}/secret`, summary: `Reveal ${p.type} provider secret` });
+        console.log(`  ${import_chalk24.default.bold("client_secret")}: ${import_chalk24.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
+      }
+    }
+  }
+}
+
 // src/commands/spec.ts
 var fs6 = __toESM(require("fs"));
-var import_chalk23 = __toESM(require("chalk"));
-var import_ora9 = __toESM(require("ora"));
+var import_chalk25 = __toESM(require("chalk"));
+var import_ora11 = __toESM(require("ora"));
+init_admin();
 async function runSpecGet(project, opts) {
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
@@ -2718,19 +3304,19 @@ async function runSpecGet(project, opts) {
 }
 async function runSpecSet(project, opts) {
   if (!opts.file) {
-    console.error(import_chalk23.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
+    console.error(import_chalk25.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
     process.exit(1);
   }
   let specContent;
   try {
     specContent = fs6.readFileSync(opts.file, "utf-8");
   } catch {
-    console.error(import_chalk23.default.red(`Cannot read file: ${opts.file}`));
+    console.error(import_chalk25.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora9.default)("Uploading spec...").start();
+  const spinner = (0, import_ora11.default)("Uploading spec...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -2747,12 +3333,13 @@ async function runSpecSet(project, opts) {
 }
 
 // src/commands/agent.ts
-var import_chalk25 = __toESM(require("chalk"));
-var import_ora10 = __toESM(require("ora"));
+var import_chalk27 = __toESM(require("chalk"));
+var import_ora12 = __toESM(require("ora"));
 init_auth();
 
 // src/lib/tools.ts
-var import_chalk24 = __toESM(require("chalk"));
+var import_chalk26 = __toESM(require("chalk"));
+init_admin();
 init_api();
 async function proj(teamId, name, version2) {
   return resolveProject(teamId, name, version2);
@@ -2770,15 +3357,15 @@ var TOOLS = [
       const key = keys.dev ?? Object.values(keys)[0];
       const url = `https://${a.name}.abz.run/${version2}/dev`;
       const tryIt = buildTryItCurl(url, auth, key);
-      const lines = [`  ${import_chalk24.default.dim("Proxy URL:")}  ${import_chalk24.default.bold(url)}`];
-      if (res.devPortal) lines.push(`  ${import_chalk24.default.dim("Dev portal:")} ${res.devPortal}`);
+      const lines = [`  ${import_chalk26.default.dim("Proxy URL:")}  ${import_chalk26.default.bold(url)}`];
+      if (res.devPortal) lines.push(`  ${import_chalk26.default.dim("Dev portal:")} ${res.devPortal}`);
       const envs = Object.keys(keys);
       if (envs.length) {
-        lines.push("", `  ${import_chalk24.default.bold("API keys")} ${import_chalk24.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
+        lines.push("", `  ${import_chalk26.default.bold("API keys")} ${import_chalk26.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
         const w = Math.max(...envs.map((e) => e.length));
-        for (const env of envs) lines.push(`    ${import_chalk24.default.cyan(env.padEnd(w))}  ${import_chalk24.default.green(keys[env])}`);
+        for (const env of envs) lines.push(`    ${import_chalk26.default.cyan(env.padEnd(w))}  ${import_chalk26.default.green(keys[env])}`);
       }
-      if (tryIt) lines.push("", `  ${import_chalk24.default.dim("Try it:")}`, `    ${import_chalk24.default.cyan(tryIt)}`);
+      if (tryIt) lines.push("", `  ${import_chalk26.default.dim("Try it:")}`, `    ${import_chalk26.default.cyan(tryIt)}`);
       return { ...res, proxy_url: url, keys, ...tryIt ? { try_it: tryIt } : {}, display: lines.join("\n") };
     }
   },
@@ -2903,6 +3490,7 @@ function findTool(name) {
 }
 
 // src/commands/agent.ts
+init_trace();
 init_types();
 var DASHBOARD_BASE5 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
 var MAX_TOOL_STEPS = 6;
@@ -2933,23 +3521,23 @@ function truncate(value, max = 1500) {
 }
 function printCost(llm) {
   const usd = llm.cost > 0 ? `$${llm.cost.toFixed(4)}` : "<$0.0001";
-  console.log(import_chalk25.default.magenta(`  \u{1F4B3} ${usd}`) + import_chalk25.default.dim(`  (${llm.model}, ${llm.total_tokens} tok)`));
+  console.log(import_chalk27.default.magenta(`  \u{1F4B3} ${usd}`) + import_chalk27.default.dim(`  (${llm.model}, ${llm.total_tokens} tok)`));
 }
 async function runAgent(opts) {
   requireAuth();
   const { teamId, teamName } = await resolveTeam(opts.team);
   const { default: inquirer2 } = await import("inquirer");
-  console.log(import_chalk25.default.bold("APIblaze agent") + import_chalk25.default.dim(`  \xB7 team ${teamName ?? teamId}`));
-  console.log(import_chalk25.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
+  console.log(import_chalk27.default.bold("APIblaze agent") + import_chalk27.default.dim(`  \xB7 team ${teamName ?? teamId}`));
+  console.log(import_chalk27.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
   const history = [];
   while (true) {
-    const { input } = await inquirer2.prompt([{ type: "input", name: "input", message: import_chalk25.default.cyan("you") + " \u203A" }]);
+    const { input } = await inquirer2.prompt([{ type: "input", name: "input", message: import_chalk27.default.cyan("you") + " \u203A" }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
     history.push({ role: "user", content: text });
     for (let step = 0; step < MAX_TOOL_STEPS; step++) {
-      const spinner = (0, import_ora10.default)({ text: "thinking...", color: "magenta" }).start();
+      const spinner = (0, import_ora12.default)({ text: "thinking...", color: "magenta" }).start();
       let resp;
       try {
         resp = await callAgent(history, teamId);
@@ -2957,21 +3545,21 @@ async function runAgent(opts) {
       } catch (err) {
         spinner.stop();
         if (err instanceof ApiError && err.status === 402) {
-          console.log(import_chalk25.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
+          console.log(import_chalk27.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
           break;
         }
         throw err;
       }
       history.push({ role: "assistant", content: resp.raw });
       printCost(resp.llm);
-      if (resp.reply) console.log(import_chalk25.default.green("agent") + " \u203A " + resp.reply);
+      if (resp.reply) console.log(import_chalk27.default.green("agent") + " \u203A " + resp.reply);
       if (!resp.action) break;
       const tool = findTool(resp.action.tool);
       if (!tool) {
         history.push({ role: "user", content: `TOOL_RESULT ${resp.action.tool}: error \u2014 unknown tool` });
         continue;
       }
-      const runSpinner = (0, import_ora10.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
+      const runSpinner = (0, import_ora12.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
       try {
         const result = await tool.run(resp.action.args, { teamId });
         runSpinner.succeed(`${tool.name} \u2713`);
@@ -2989,11 +3577,11 @@ async function runAgent(opts) {
       }
       renderTrace();
       if (step === MAX_TOOL_STEPS - 1) {
-        console.log(import_chalk25.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
+        console.log(import_chalk27.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
       }
     }
   }
-  console.log(import_chalk25.default.dim("\nBye."));
+  console.log(import_chalk27.default.dim("\nBye."));
 }
 
 // src/commands/config-browse.ts
@@ -3140,7 +3728,7 @@ var SETTING_GROUPS = ["Basics", "Traffic & limits", "Access & auth", "Portal & M
 var FEATURES = [
   { go: "transforms", label: "Transforms", desc: "Rewrite requests/responses (headers, body fields) without touching your upstream" },
   { go: "mappings", label: "Mapping tables", desc: "Reusable value-mapping tables used by map transforms (values can be hidden/encrypted)" },
-  { go: "tenants", label: "Tenants", desc: "Separate groups of your API consumers \u2014 each with its own portal, login, and keys" },
+  { go: "tenants", label: "Tenants", desc: "Consumer groups \u2014 portal, login app clients & providers, issuers, IAM, CORS" },
   { go: "domains", label: "Custom domains", desc: "Serve the proxy on your own hostname + choose what the bare URL serves" },
   { go: "spec", label: "OpenAPI spec & traffic", desc: "View the stored spec, refresh it from source, or build it from captured traffic" },
   { go: "agents", label: "AI agents", desc: "Chat to build your spec, design access rules, or publish an MCP server (billed per turn)" },
@@ -3156,11 +3744,11 @@ function dig(blob, dotted) {
 }
 var readSetting = (s, cfg) => s.read ? s.read(cfg) : dig(cfg, s.key);
 function show(v) {
-  if (v === void 0) return import_chalk26.default.dim("(unset)");
-  if (v === null) return import_chalk26.default.dim("null");
-  if (typeof v === "object") return import_chalk26.default.cyan(JSON.stringify(v));
-  if (typeof v === "boolean") return v ? import_chalk26.default.green("on") : import_chalk26.default.red("off");
-  return import_chalk26.default.cyan(String(v));
+  if (v === void 0) return import_chalk28.default.dim("(unset)");
+  if (v === null) return import_chalk28.default.dim("null");
+  if (typeof v === "object") return import_chalk28.default.cyan(JSON.stringify(v));
+  if (typeof v === "boolean") return v ? import_chalk28.default.green("on") : import_chalk28.default.red("off");
+  return import_chalk28.default.cyan(String(v));
 }
 function parseValue(raw) {
   if (raw === "true") return true;
@@ -3187,7 +3775,7 @@ async function fetchConfigBlob(proj2) {
 }
 async function patchSetting(proj2, s, value, cfg) {
   const body = s.toPatch(value, cfg);
-  const spinner = (0, import_ora11.default)(`Set ${s.key}...`).start();
+  const spinner = (0, import_ora13.default)(`Set ${s.key}...`).start();
   try {
     await admin({
       method: "PATCH",
@@ -3202,10 +3790,10 @@ async function patchSetting(proj2, s, value, cfg) {
   }
 }
 var loginFirst = (what) => {
-  console.log(import_chalk26.default.yellow(`
+  console.log(import_chalk28.default.yellow(`
   Log in first to ${what}.`));
-  console.log(import_chalk26.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
-  console.log(import_chalk26.default.dim("  anonymously and want to bring it into your account.\n"));
+  console.log(import_chalk28.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
+  console.log(import_chalk28.default.dim("  anonymously and want to bring it into your account.\n"));
 };
 async function runConfig(project, key, value, opts) {
   const creds = loadCredentials();
@@ -3222,9 +3810,9 @@ async function runConfig(project, key, value, opts) {
   }
   const setting = SETTINGS.find((s) => s.key === key);
   if (!setting) {
-    console.error(import_chalk26.default.red(`Unknown setting "${key}".`));
-    console.error(import_chalk26.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
-    console.error(import_chalk26.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
+    console.error(import_chalk28.default.red(`Unknown setting "${key}".`));
+    console.error(import_chalk28.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
+    console.error(import_chalk28.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
     process.exit(1);
   }
   if (value === void 0) {
@@ -3239,7 +3827,7 @@ async function pickProject(teamId) {
   const { getProjects: getProjects2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const projects = await getProjects2(teamId).catch(() => []);
   if (!projects.length) {
-    console.error(import_chalk26.default.red("No projects in this team. Create one: `npx apiblaze create`."));
+    console.error(import_chalk28.default.red("No projects in this team. Create one: `npx apiblaze create`."));
     process.exit(1);
   }
   const { default: inquirer2 } = await import("inquirer");
@@ -3247,7 +3835,7 @@ async function pickProject(teamId) {
     type: "list",
     name: "picked",
     message: "Which project?",
-    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk26.default.dim("v" + p.apiVersion)}`, value: p }))
+    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk28.default.dim("v" + p.apiVersion)}`, value: p }))
   }]);
   return { projectId: picked.projectId, projectName: picked.projectName, apiVersion: picked.apiVersion, teamId, tenant: picked.tenant };
 }
@@ -3258,25 +3846,25 @@ function printAll(proj2, cfg, json) {
     console.log(JSON.stringify(out, null, 2));
     return;
   }
-  console.log(import_chalk26.default.bold(`
+  console.log(import_chalk28.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 settings
 `));
   for (const group of SETTING_GROUPS) {
-    console.log(import_chalk26.default.bold(group));
+    console.log(import_chalk28.default.bold(group));
     for (const s of SETTINGS.filter((x) => x.group === group)) {
-      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk26.default.dim(s.desc)}`);
+      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk28.default.dim(s.desc)}`);
     }
     console.log();
   }
-  console.log(import_chalk26.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
+  console.log(import_chalk28.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
 }
 async function discoveryMenu(project) {
   const { default: inquirer2 } = await import("inquirer");
-  console.log(import_chalk26.default.bold(`
+  console.log(import_chalk28.default.bold(`
 APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
 `));
-  console.log(import_chalk26.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
-  console.log(import_chalk26.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
+  console.log(import_chalk28.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
+  console.log(import_chalk28.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
   for (; ; ) {
     const { pick: pick2 } = await inquirer2.prompt([{
       type: "list",
@@ -3284,13 +3872,13 @@ APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
       message: "Explore:",
       pageSize: 20,
       choices: [
-        new inquirer2.Separator(import_chalk26.default.bold("\u2014 Settings \u2014")),
+        new inquirer2.Separator(import_chalk28.default.bold("\u2014 Settings \u2014")),
         ...SETTING_GROUPS.map((g) => ({
-          name: `${g}  ${import_chalk26.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
+          name: `${g}  ${import_chalk28.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
           value: { kind: "settings", g }
         })),
-        new inquirer2.Separator(import_chalk26.default.bold("\u2014 Features \u2014")),
-        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk26.default.dim(f.desc)}`, value: { kind: "feature", f } })),
+        new inquirer2.Separator(import_chalk28.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk28.default.dim(f.desc)}`, value: { kind: "feature", f } })),
         new inquirer2.Separator(),
         { name: "Exit", value: { kind: "exit" } }
       ]
@@ -3299,24 +3887,24 @@ APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
     if (pick2.kind === "settings") {
       console.log();
       for (const s of SETTINGS.filter((x) => x.group === pick2.g)) {
-        console.log(`  ${import_chalk26.default.bold(s.label.padEnd(28))} ${import_chalk26.default.dim(s.desc)}`);
-        console.log(`  ${import_chalk26.default.dim("  key: " + s.key)}`);
+        console.log(`  ${import_chalk28.default.bold(s.label.padEnd(28))} ${import_chalk28.default.dim(s.desc)}`);
+        console.log(`  ${import_chalk28.default.dim("  key: " + s.key)}`);
       }
       loginFirst("view or change these settings");
     } else {
       const f = pick2.f;
       console.log(`
-  ${import_chalk26.default.bold(f.label)} \u2014 ${f.desc}`);
+  ${import_chalk28.default.bold(f.label)} \u2014 ${f.desc}`);
       loginFirst(`use ${f.label.toLowerCase()}`);
     }
   }
 }
 async function navigator(proj2, cfg, opts) {
   const { default: inquirer2 } = await import("inquirer");
-  console.log(import_chalk26.default.bold(`
+  console.log(import_chalk28.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
 `));
-  console.log(import_chalk26.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
+  console.log(import_chalk28.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
   let blob = cfg;
   for (; ; ) {
     const { pick: pick2 } = await inquirer2.prompt([{
@@ -3325,10 +3913,10 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
       message: "Where to?",
       pageSize: 20,
       choices: [
-        new inquirer2.Separator(import_chalk26.default.bold("\u2014 Settings \u2014")),
+        new inquirer2.Separator(import_chalk28.default.bold("\u2014 Settings \u2014")),
         ...SETTING_GROUPS.map((g) => ({ name: g, value: { kind: "settings", g } })),
-        new inquirer2.Separator(import_chalk26.default.bold("\u2014 Features \u2014")),
-        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk26.default.dim(f.desc)}`, value: { kind: f.go } })),
+        new inquirer2.Separator(import_chalk28.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk28.default.dim(f.desc)}`, value: { kind: f.go } })),
         new inquirer2.Separator(),
         { name: "Show all settings", value: { kind: "list" } },
         { name: "Exit", value: { kind: "exit" } }
@@ -3368,7 +3956,7 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
         }
       }
     } catch (err) {
-      console.error(import_chalk26.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+      console.error(import_chalk28.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     }
   }
 }
@@ -3382,7 +3970,7 @@ async function settingsGroup(proj2, cfg, group) {
       message: group + ":",
       pageSize: 16,
       choices: [
-        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk26.default.dim(s2.desc)}`, value: s2 })),
+        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk28.default.dim(s2.desc)}`, value: s2 })),
         new inquirer2.Separator(),
         { name: "\u2190 Back", value: null }
       ]
@@ -3400,7 +3988,7 @@ async function settingsGroup(proj2, cfg, group) {
     } else if (s.type === "number") {
       const { v } = await inquirer2.prompt([{ type: "input", name: "v", message: `${s.label} (number):`, default: readSetting(s, cfg) }]);
       if (v === "" || Number.isNaN(Number(v))) {
-        console.log(import_chalk26.default.yellow("  Not a number \u2014 unchanged."));
+        console.log(import_chalk28.default.yellow("  Not a number \u2014 unchanged."));
         continue;
       }
       value = Number(v);
@@ -3418,6 +4006,102 @@ async function settingsGroup(proj2, cfg, group) {
     cfg = await fetchConfigBlob(proj2);
   }
 }
+var FN_CHOICES = [
+  { name: "uppercase", value: "uppercase" },
+  { name: "lowercase", value: "lowercase" },
+  { name: "trim", value: "trim" },
+  { name: "url_encode", value: "url_encode" },
+  { name: "url_decode", value: "url_decode" },
+  { name: "base64url_encode", value: "base64url_encode" },
+  { name: "base64url_decode", value: "base64url_decode" },
+  { name: "hash \u2014 sha256/md5 digest", value: "hash" },
+  { name: "regex_extract \u2014 pull out a capture group", value: "regex_extract" },
+  { name: "concat \u2014 prepend/append text", value: "concat" }
+];
+async function buildFns(which) {
+  const { default: inquirer2 } = await import("inquirer");
+  const fns = [];
+  for (; ; ) {
+    const { fn } = await inquirer2.prompt([{
+      type: "list",
+      name: "fn",
+      message: fns.length ? `${which}: ${fns.map((f) => f.fn).join(" \u2192 ")} \u2014 add another?` : `${which} \u2014 add a function?`,
+      choices: [{ name: fns.length ? "\u2713 Done" : "No functions", value: null }, ...FN_CHOICES]
+    }]);
+    if (!fn) return fns;
+    if (fn === "hash") {
+      const { algorithm } = await inquirer2.prompt([{ type: "list", name: "algorithm", message: "Algorithm:", choices: ["sha256", "md5"] }]);
+      fns.push({ fn, algorithm });
+    } else if (fn === "regex_extract") {
+      const a = await inquirer2.prompt([
+        { type: "input", name: "pattern", message: "Regex pattern:", validate: (s) => {
+          try {
+            new RegExp(s);
+            return true;
+          } catch {
+            return "invalid regex";
+          }
+        } },
+        { type: "input", name: "group", message: "Capture group (default 1):", default: "1" }
+      ]);
+      fns.push({ fn, pattern: a.pattern, ...Number(a.group) !== 1 ? { group: Number(a.group) } : {} });
+    } else if (fn === "concat") {
+      const a = await inquirer2.prompt([
+        { type: "input", name: "before", message: "Text before (empty = none):" },
+        { type: "input", name: "after", message: "Text after (empty = none):" }
+      ]);
+      fns.push({ fn, ...a.before ? { before: a.before } : {}, ...a.after ? { after: a.after } : {} });
+    } else {
+      fns.push({ fn });
+    }
+  }
+}
+async function buildCondition(phase) {
+  const { default: inquirer2 } = await import("inquirer");
+  const { want } = await inquirer2.prompt([{
+    type: "confirm",
+    name: "want",
+    default: false,
+    message: "Only apply when a condition matches?"
+  }]);
+  if (!want) return void 0;
+  const srcHint = phase === "response" ? "(header:x-foo, bodyvar:user.id, status:)" : "(header:x-foo, param:limit, bodyvar:user.id, jwt:sub)";
+  const items = [];
+  for (; ; ) {
+    const a = await inquirer2.prompt([
+      { type: "input", name: "source", message: `Condition field ${import_chalk28.default.dim(srcHint)}:`, validate: (s) => !!s || "required" },
+      { type: "list", name: "operator", message: "Operator:", choices: [
+        "eq",
+        "neq",
+        "contains",
+        "starts_with",
+        "ends_with",
+        "exists",
+        "not_exists",
+        "regex"
+      ] }
+    ]);
+    let value;
+    if (a.operator !== "exists" && a.operator !== "not_exists") {
+      const v = await inquirer2.prompt([{ type: "input", name: "value", message: a.operator === "regex" ? "Pattern:" : "Value:" }]);
+      value = v.value;
+    }
+    items.push({ id: `c${items.length + 1}`, openParen: false, closeParen: false, source: a.source, operator: a.operator, ...value !== void 0 ? { value } : {} });
+    const { more } = await inquirer2.prompt([{
+      type: "list",
+      name: "more",
+      message: "Combine with another condition?",
+      choices: [{ name: "\u2713 Done", value: null }, { name: "AND \u2026", value: "AND" }, { name: "OR \u2026", value: "OR" }]
+    }]);
+    if (!more) return items;
+    items[items.length - 1].logicOp = more;
+  }
+}
+function showCondition(cond) {
+  if (!Array.isArray(cond) || !cond.length) return "";
+  const s = cond.map((c) => `${c.source} ${c.operator}${c.value !== void 0 ? ` "${c.value}"` : ""}${c.logicOp ? ` ${c.logicOp}` : ""}`).join(" ");
+  return import_chalk28.default.dim(`  when ${s}`);
+}
 async function transformsMenu(proj2) {
   const { default: inquirer2 } = await import("inquirer");
   const base = `/projects/${proj2.projectId}/${proj2.apiVersion}/transforms`;
@@ -3425,11 +4109,12 @@ async function transformsMenu(proj2) {
     const out = await admin({ method: "GET", path: base, summary: "List transform rules" });
     const rules = out?.rules ?? [];
     console.log();
-    if (!rules.length) console.log(import_chalk26.default.dim("  No transform rules yet."));
+    if (!rules.length) console.log(import_chalk28.default.dim("  No transform rules yet."));
     for (const r of rules) {
       const a = r.action ?? {};
-      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}`;
-      console.log(`  ${r.enabled ? import_chalk26.default.green("\u25CF") : import_chalk26.default.dim("\u25CB")} ${import_chalk26.default.bold(r.name)}  ${import_chalk26.default.dim(`[${r.phase ?? "request"}]`)}  ${what}`);
+      const fns = [...a.source_fns ?? [], ...a.dest_fns ?? []].map((f) => f.fn);
+      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}${fns.length ? import_chalk28.default.dim(` via ${fns.join("\u2192")}`) : ""}`;
+      console.log(`  ${r.enabled ? import_chalk28.default.green("\u25CF") : import_chalk28.default.dim("\u25CB")} ${import_chalk28.default.bold(r.name)}  ${import_chalk28.default.dim(`[${r.phase ?? "request"}]`)}  ${what}${showCondition(r.condition)}`);
     }
     const { act } = await inquirer2.prompt([{
       type: "list",
@@ -3441,10 +4126,26 @@ async function transformsMenu(proj2) {
           { name: "Enable/disable a rule", value: "toggle" },
           { name: "Delete a rule", value: "delete" }
         ] : [],
+        { name: import_chalk28.default.dim("Add from raw JSON (grouped conditions, lookup tables, \u2026)"), value: "raw" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
     if (act === "back") return;
+    if (act === "raw") {
+      const { raw } = await inquirer2.prompt([{
+        type: "input",
+        name: "raw",
+        message: "Rule JSON ({name, phase, enabled, action, condition?}):"
+      }]);
+      const body = parseValue(raw);
+      if (!body || typeof body !== "object" || Array.isArray(body)) {
+        console.log(import_chalk28.default.yellow("  Not a JSON object \u2014 skipped."));
+        continue;
+      }
+      await admin({ method: "POST", path: base, body, summary: "Create transform rule (raw JSON)" });
+      console.log(import_chalk28.default.green("  Rule created."));
+      continue;
+    }
     if (act === "add") {
       const ans = await inquirer2.prompt([
         { type: "input", name: "name", message: "Rule name:", validate: (s) => !!s || "required" },
@@ -3458,7 +4159,7 @@ async function transformsMenu(proj2) {
           { name: "Remove a field", value: "remove" }
         ] }
       ]);
-      const fieldHint = import_chalk26.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
+      const fieldHint = import_chalk28.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
       let action2;
       if (ans.kind === "hardcode") {
         const a = await inquirer2.prompt([
@@ -3477,11 +4178,26 @@ async function transformsMenu(proj2) {
           { type: "input", name: "destination", message: `Destination field ${fieldHint}:`, validate: (s) => !!s || "required" },
           { type: "confirm", name: "strip", message: "Remove the source field after copying?", default: false }
         ]);
-        action2 = { type: "copy", source: a.source, destination: a.destination, ...a.strip ? { strip_source: true } : {} };
+        const source_fns = await buildFns("Transform the value as it is READ (source functions)");
+        const dest_fns = await buildFns("Transform the value as it is WRITTEN (destination functions)");
+        action2 = {
+          type: "copy",
+          source: a.source,
+          destination: a.destination,
+          ...a.strip ? { strip_source: true } : {},
+          ...source_fns.length ? { source_fns } : {},
+          ...dest_fns.length ? { dest_fns } : {}
+        };
       }
-      const spinner = (0, import_ora11.default)("Creating rule...").start();
+      const condition = await buildCondition(ans.phase);
+      const spinner = (0, import_ora13.default)("Creating rule...").start();
       try {
-        await admin({ method: "POST", path: base, body: { name: ans.name, phase: ans.phase, enabled: true, action: action2 }, summary: `Create transform "${ans.name}"` });
+        await admin({
+          method: "POST",
+          path: base,
+          body: { name: ans.name, phase: ans.phase, enabled: true, action: action2, ...condition ? { condition } : {} },
+          summary: `Create transform "${ans.name}"`
+        });
         spinner.succeed(`Rule "${ans.name}" created.`);
       } catch (err) {
         spinner.fail("Create failed.");
@@ -3492,16 +4208,16 @@ async function transformsMenu(proj2) {
         type: "list",
         name: "rule",
         message: act === "toggle" ? "Which rule?" : "Delete which rule?",
-        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk26.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
+        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk28.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
       }]);
       if (!rule) continue;
       if (act === "toggle") {
         const flipped = { ...rule, enabled: rule.enabled === false };
         await admin({ method: "PUT", path: `${base}/${rule.id}`, body: flipped, summary: `${flipped.enabled ? "Enable" : "Disable"} transform "${rule.name}"` });
-        console.log(import_chalk26.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
+        console.log(import_chalk28.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
       } else {
         await admin({ method: "DELETE", path: `${base}/${rule.id}`, summary: `Delete transform "${rule.name}"` });
-        console.log(import_chalk26.default.green(`  ${rule.name} deleted.`));
+        console.log(import_chalk28.default.green(`  ${rule.name} deleted.`));
       }
     }
   }
@@ -3513,9 +4229,9 @@ async function mappingsMenu(proj2) {
     const out = await admin({ method: "GET", path: base, summary: "List mapping tables" });
     const tables = out?.mappings ?? out?.tables ?? [];
     console.log();
-    if (!tables.length) console.log(import_chalk26.default.dim("  No mapping tables yet."));
+    if (!tables.length) console.log(import_chalk28.default.dim("  No mapping tables yet."));
     for (const t of tables) {
-      console.log(`  ${import_chalk26.default.bold(t.name)}  ${import_chalk26.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
+      console.log(`  ${import_chalk28.default.bold(t.name)}  ${import_chalk28.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
     }
     const { act } = await inquirer2.prompt([{
       type: "list",
@@ -3535,11 +4251,11 @@ async function mappingsMenu(proj2) {
       ]);
       const entries2 = parseValue(a.entries);
       if (!Array.isArray(entries2)) {
-        console.log(import_chalk26.default.yellow("  Entries must be a JSON array \u2014 not created."));
+        console.log(import_chalk28.default.yellow("  Entries must be a JSON array \u2014 not created."));
         continue;
       }
       await admin({ method: "POST", path: base, body: { name: a.name, entries: entries2 }, summary: `Create mapping table "${a.name}"` });
-      console.log(import_chalk26.default.green(`  Table "${a.name}" created.`));
+      console.log(import_chalk28.default.green(`  Table "${a.name}" created.`));
     } else {
       const { table } = await inquirer2.prompt([{
         type: "list",
@@ -3549,7 +4265,7 @@ async function mappingsMenu(proj2) {
       }]);
       if (!table) continue;
       await admin({ method: "DELETE", path: `${base}/${table.id}`, summary: `Delete mapping table "${table.name}"` });
-      console.log(import_chalk26.default.green(`  ${table.name} deleted.`));
+      console.log(import_chalk28.default.green(`  ${table.name} deleted.`));
     }
   }
 }
@@ -3560,22 +4276,22 @@ async function tenantsMenu(proj2, opts) {
     const out = await admin({ method: "GET", path: base, summary: "List attached tenants" });
     const tenants = out?.tenants ?? [];
     console.log();
-    if (!tenants.length) console.log(import_chalk26.default.dim("  No tenants attached (consumers use the default tenant)."));
-    for (const t of tenants) console.log(`  ${import_chalk26.default.bold(t.tenant_name ?? t.name)}  ${import_chalk26.default.dim(t.display_name ?? "")}`);
+    if (!tenants.length) console.log(import_chalk28.default.dim("  No tenants attached (consumers use the default tenant)."));
+    for (const t of tenants) console.log(`  ${import_chalk28.default.bold(t.tenant_name ?? t.name)}  ${import_chalk28.default.dim(t.display_name ?? "")}`);
     const { act } = await inquirer2.prompt([{
       type: "list",
       name: "act",
       message: "Tenants:",
       choices: [
-        { name: "Attach a tenant", value: "attach" },
-        ...tenants.length ? [{ name: "Detach a tenant", value: "detach" }] : [],
-        { name: import_chalk26.default.dim("Manage team tenants (create/CORS/login) \u2192 `apiblaze tenant --help`"), value: "hint" },
+        { name: `Manage a tenant\u2026  ${import_chalk28.default.dim("settings, login app clients, providers, issuers \u2014 affects EVERY proxy the tenant serves")}`, value: "manage" },
+        { name: "Attach a tenant to this project", value: "attach" },
+        ...tenants.length ? [{ name: "Detach a tenant from this project", value: "detach" }] : [],
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
     if (act === "back") return;
-    if (act === "hint") {
-      console.log(import_chalk26.default.dim("\n  apiblaze tenant list | create | attach | cors | delete\n"));
+    if (act === "manage") {
+      await runTenantManage(void 0, { team: opts.team });
       continue;
     }
     if (act === "attach") {
@@ -3590,7 +4306,7 @@ async function tenantsMenu(proj2, opts) {
       }]);
       if (!t) continue;
       await admin({ method: "DELETE", path: `${base}/${encodeURIComponent(t.tenant_name ?? t.name)}`, summary: `Detach tenant ${t.tenant_name ?? t.name}` });
-      console.log(import_chalk26.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
+      console.log(import_chalk28.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
     }
   }
 }
@@ -3633,7 +4349,7 @@ async function specMenu(proj2, opts) {
     choices: [
       { name: "Print the stored spec", value: "get" },
       { name: "Refresh the spec from its source", value: "refresh" },
-      { name: import_chalk26.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
+      { name: import_chalk28.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -3641,7 +4357,7 @@ async function specMenu(proj2, opts) {
   if (act === "get") await runSpecGet(proj2.projectName, { team: opts.team, apiversion: proj2.apiVersion });
   else if (act === "refresh") {
     await admin({ method: "POST", path: `/projects/${proj2.projectId}/${proj2.apiVersion}/refresh-spec`, summary: "Refresh spec from source" });
-    console.log(import_chalk26.default.green("  Spec refresh triggered."));
+    console.log(import_chalk28.default.green("  Spec refresh triggered."));
   } else await runOpenapi(proj2.projectName, proj2.apiVersion);
 }
 async function agentsMenu(proj2, opts) {
@@ -3666,8 +4382,9 @@ async function agentsMenu(proj2, opts) {
 }
 
 // src/commands/key.ts
-var import_chalk27 = __toESM(require("chalk"));
-var import_ora12 = __toESM(require("ora"));
+var import_chalk29 = __toESM(require("chalk"));
+var import_ora14 = __toESM(require("ora"));
+init_admin();
 async function runApikeysMenu(opts) {
   await runKeyList(opts);
   if (opts.json) return;
@@ -3694,11 +4411,11 @@ async function runKeyList(opts) {
     return;
   }
   if (!keys.length) {
-    console.log(import_chalk27.default.yellow("No developer keys."));
+    console.log(import_chalk29.default.yellow("No developer keys."));
     return;
   }
   for (const k of keys) {
-    console.log(`  ${import_chalk27.default.bold(k.key_id ?? k.id)}  ${import_chalk27.default.dim(k.description ?? "")}  ${import_chalk27.default.dim(k.expires_at ?? "no expiry")}`);
+    console.log(`  ${import_chalk29.default.bold(k.key_id ?? k.id)}  ${import_chalk29.default.dim(k.description ?? "")}  ${import_chalk29.default.dim(k.expires_at ?? "no expiry")}`);
   }
 }
 async function runKeyMint(opts) {
@@ -3706,7 +4423,7 @@ async function runKeyMint(opts) {
   const body = { role: "consumer-admin" };
   if (opts.desc) body.description = opts.desc;
   if (opts.expiresDays) body.expires_in_seconds = Number(opts.expiresDays) * 24 * 60 * 60;
-  const spinner = (0, import_ora12.default)("Minting key...").start();
+  const spinner = (0, import_ora14.default)("Minting key...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -3719,9 +4436,9 @@ async function runKeyMint(opts) {
       console.log(JSON.stringify(out));
       return;
     }
-    console.log(`  ${import_chalk27.default.bold("key_id")}:  ${out?.key_id}`);
-    console.log(`  ${import_chalk27.default.bold("key")}:     ${import_chalk27.default.green(out?.key)}  ${import_chalk27.default.dim("(shown once \u2014 store it now)")}`);
-    if (out?.expires_at) console.log(`  ${import_chalk27.default.dim("expires:")} ${out.expires_at}`);
+    console.log(`  ${import_chalk29.default.bold("key_id")}:  ${out?.key_id}`);
+    console.log(`  ${import_chalk29.default.bold("key")}:     ${import_chalk29.default.green(out?.key)}  ${import_chalk29.default.dim("(shown once \u2014 store it now)")}`);
+    if (out?.expires_at) console.log(`  ${import_chalk29.default.dim("expires:")} ${out.expires_at}`);
   } catch (err) {
     spinner.fail("Mint failed.");
     throw err;
@@ -3729,7 +4446,7 @@ async function runKeyMint(opts) {
 }
 async function runKeyRevoke(keyId, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora12.default)("Revoking key...").start();
+  const spinner = (0, import_ora14.default)("Revoking key...").start();
   try {
     await admin({
       method: "DELETE",
@@ -3744,8 +4461,9 @@ async function runKeyRevoke(keyId, opts) {
 }
 
 // src/commands/consumer.ts
-var import_chalk28 = __toESM(require("chalk"));
-var import_ora13 = __toESM(require("ora"));
+var import_chalk30 = __toESM(require("chalk"));
+var import_ora15 = __toESM(require("ora"));
+init_admin();
 var DEFAULT_SCOPE = "openid email profile offline_access";
 var APIKEYS_BASE = process.env.APIBLAZE_APIKEYS_BASE || "https://apikeys.apiblaze.com";
 async function consumerFetch(creds, suffix, init) {
@@ -3764,7 +4482,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk28.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk30.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -3775,48 +4493,37 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk28.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk30.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
     requireAuth();
     const { teamId, teamName } = await resolveTeam(opts.team);
-    const spinner = (0, import_ora13.default)("Loading your tenants...").start();
-    const tdata = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants?detail=1`, summary: `List tenants for ${teamName ?? teamId}` });
-    spinner.stop();
-    const tenants = (tdata?.tenants ?? []).map(
-      (t) => typeof t === "string" ? { tenant_name: t } : t
-    );
-    if (!tenants.length) {
-      console.error(import_chalk28.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
-      process.exit(1);
-    }
     if (!tenant2) {
-      if (tenants.length === 1) tenant2 = tenants[0].tenant_name;
-      else {
-        const { chosen } = await inquirer2.prompt([{ type: "list", name: "chosen", message: "Which tenant portal?", choices: tenants.map((t) => ({ name: t.display_name ? `${t.display_name} (${t.tenant_name})` : t.tenant_name, value: t.tenant_name })) }]);
-        tenant2 = chosen;
-      }
+      const { pickTenant: pickTenant2 } = await Promise.resolve().then(() => (init_tenant_pick(), tenant_pick_exports));
+      const picked = await pickTenant2(teamId, { message: `Which tenant portal${teamName ? ` (team ${teamName})` : ""}?` });
+      if (!picked) process.exit(1);
+      tenant2 = picked;
     }
-    const s2 = (0, import_ora13.default)("Finding the login app...").start();
+    const s2 = (0, import_ora15.default)("Finding the login app...").start();
     const clients = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`, summary: `List app clients for ${tenant2}` }).catch(() => []);
     s2.stop();
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk28.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk30.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
   const portalResource = `https://${tenant2}.portal.apiblaze.com/1.0.0`;
-  console.log(`${import_chalk28.default.cyan("\u2192")} Logging in to ${import_chalk28.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk30.default.cyan("\u2192")} Logging in to ${import_chalk30.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk28.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk28.default.bold(userCode)}
+  Open: ${import_chalk30.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk30.default.bold(userCode)}
 `);
-    console.log(import_chalk28.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk30.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   }, portalResource);
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -3831,7 +4538,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk28.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk30.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer();
@@ -3844,29 +4551,29 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk28.default.cyan("Consumer")} ${import_chalk28.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk28.default.bold(fresh.tenant)}
+  console.log(`${import_chalk30.default.cyan("Consumer")} ${import_chalk30.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk30.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk28.default.bold("access_token")}  ${import_chalk28.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk30.default.bold("access_token")}  ${import_chalk30.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk28.default.bold("id_token")}      ${import_chalk28.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk30.default.bold("id_token")}      ${import_chalk30.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk28.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk30.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk28.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk30.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer();
   const { default: inquirer2 } = await import("inquirer");
-  const spinner = (0, import_ora13.default)("Loading your API keys...").start();
+  const spinner = (0, import_ora15.default)("Loading your API keys...").start();
   const list = await consumerFetch(creds, "/apikeys");
   const revealed = await consumerFetch(list.creds, "/apikeys/reveal").catch(() => ({ status: 0, data: null, creds: list.creds }));
   spinner.stop();
   if (list.status >= 400) {
-    console.error(import_chalk28.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk28.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk30.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk30.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   const keys = list.data?.keys ?? [];
@@ -3874,16 +4581,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk28.default.yellow("No API keys yet."));
+    console.log(import_chalk30.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk28.default.green(clear) : import_chalk28.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk28.default.dim(`exp ${k.expires_at}`) : import_chalk28.default.dim("no expiry");
-      console.log(`  ${import_chalk28.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk28.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk30.default.green(clear) : import_chalk30.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk30.default.dim(`exp ${k.expires_at}`) : import_chalk30.default.dim("no expiry");
+      console.log(`  ${import_chalk30.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk30.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk28.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk30.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -3897,7 +4604,7 @@ async function runConsumerApikeys(opts) {
   const body = { environment: answers.environment };
   if (answers.description) body.description = answers.description;
   if (answers.expiresDays) body.expires_in_seconds = Number(answers.expiresDays) * 86400;
-  const s2 = (0, import_ora13.default)("Creating key...").start();
+  const s2 = (0, import_ora15.default)("Creating key...").start();
   const created = await consumerFetch(list.creds, "/apikeys", { method: "POST", body: JSON.stringify(body) });
   if (created.status >= 400) {
     s2.fail(`Create failed (${created.status}): ${created.data?.error ?? ""}`);
@@ -3905,15 +4612,16 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk28.default.green(key)}  ${import_chalk28.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk28.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk30.default.green(key)}  ${import_chalk30.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk30.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk29 = __toESM(require("chalk"));
-var import_ora14 = __toESM(require("ora"));
+var import_chalk31 = __toESM(require("chalk"));
+var import_ora16 = __toESM(require("ora"));
 var fs7 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
+init_admin();
 init_auth();
 function detectNextProject(root) {
   const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f) => fs7.existsSync(path4.join(root, f)));
@@ -3951,18 +4659,18 @@ function upsertEnvLocal(root, token) {
 }
 function installSidecarPackage(root) {
   if (fs7.existsSync(path4.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk29.default.green("\u2713")} apiblaze package already installed`);
+    console.log(`  ${import_chalk31.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
   const has = (f) => fs7.existsSync(path4.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
-  const spinner = (0, import_ora14.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
+  const spinner = (0, import_ora16.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
     const { execSync } = require("child_process");
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk29.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk29.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk31.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk31.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
@@ -4101,7 +4809,7 @@ async function runAnonymousInit(root, router, opts) {
   const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const { saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
-  const spinner = (0, import_ora14.default)("Setting up a sidecar (no login needed)...").start();
+  const spinner = (0, import_ora16.default)("Setting up a sidecar (no login needed)...").start();
   let out;
   try {
     out = await sidecarInitAnonymous2();
@@ -4113,29 +4821,29 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk29.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk29.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk31.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk31.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk29.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk31.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk29.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk29.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk31.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk31.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk29.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk31.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk29.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk29.default.cyan("apiblaze login")}  then  ${import_chalk29.default.cyan("apiblaze claim")}   ${import_chalk29.default.dim("(no code needed here)")}`);
-  console.log(import_chalk29.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk31.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk31.default.cyan("apiblaze login")}  then  ${import_chalk31.default.cyan("apiblaze claim")}   ${import_chalk31.default.dim("(no code needed here)")}`);
+  console.log(import_chalk31.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
   const root = path4.resolve(opts.dir ?? process.cwd());
   const detected = detectNextProject(root);
   if (!detected.found) {
-    console.log(import_chalk29.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log(import_chalk31.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
@@ -4146,10 +4854,10 @@ async function runSidecar(opts) {
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk29.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk29.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk31.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk31.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk29.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk31.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -4158,7 +4866,7 @@ async function runSidecar(opts) {
   const mustMint = !existingKey || opts.rotate || switchingTeam;
   let token = existingKey ?? "";
   if (mustMint) {
-    const spinner = (0, import_ora14.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+    const spinner = (0, import_ora16.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
     try {
       const out = await admin({
         method: "POST",
@@ -4172,39 +4880,40 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk29.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk31.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk29.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk31.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk29.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk31.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected.router);
-    if (inspectorPath) console.log(`  ${import_chalk29.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk31.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk29.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk29.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk29.default.bold("candidates")} \u2014 list them:  ${import_chalk29.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk29.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk31.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk31.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk31.default.bold("candidates")} \u2014 list them:  ${import_chalk31.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk31.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk29.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path4.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk29.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk31.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path4.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk31.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk29.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk29.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk29.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk31.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk31.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk31.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk29.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk29.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk31.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk31.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk30 = __toESM(require("chalk"));
-var import_ora15 = __toESM(require("ora"));
+var import_chalk32 = __toESM(require("chalk"));
+var import_ora17 = __toESM(require("ora"));
+init_admin();
 init_auth();
 init_anon_cred();
 async function runOriginsList(opts) {
@@ -4212,7 +4921,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk30.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk32.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -4230,30 +4939,30 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk30.default.bold(`
+  console.log(import_chalk32.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk30.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk30.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk30.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk30.default.bold(`
+  if (!routed.length) console.log(import_chalk32.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk32.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk32.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk32.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk30.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk32.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk30.default.yellow("\u25CB")} ${c.origin}  ${import_chalk30.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk32.default.yellow("\u25CB")} ${c.origin}  ${import_chalk32.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk30.default.dim(`
+    console.log(import_chalk32.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk30.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk32.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk30.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk32.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
-    const spinner2 = (0, import_ora15.default)(`Approving ${origin} (anonymous)...`).start();
+    const spinner2 = (0, import_ora17.default)(`Approving ${origin} (anonymous)...`).start();
     try {
       const out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/approve`, { method: "POST", body: JSON.stringify({ origin }) });
       spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
@@ -4264,7 +4973,7 @@ async function runOriginsApprove(origin, opts) {
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora15.default)(`Approving ${origin}...`).start();
+  const spinner = (0, import_ora17.default)(`Approving ${origin}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -4281,7 +4990,7 @@ async function runOriginsApprove(origin, opts) {
 }
 async function runOriginsDeny(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora15.default)(`Dismissing ${origin}...`).start();
+  const spinner = (0, import_ora17.default)(`Dismissing ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
     spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
@@ -4292,7 +5001,7 @@ async function runOriginsDeny(origin, opts) {
 }
 async function runOriginsRemove(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora15.default)(`Removing the proxy for ${origin}...`).start();
+  const spinner = (0, import_ora17.default)(`Removing the proxy for ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/remove`, body: { origin }, summary: `Un-route sidecar origin ${origin}` });
     spinner.succeed(`Removed ${origin}. Your app will stop routing it (goes direct) within ~5 min.`);
@@ -4303,8 +5012,9 @@ async function runOriginsRemove(origin, opts) {
 }
 
 // src/commands/op.ts
-var import_chalk31 = __toESM(require("chalk"));
+var import_chalk33 = __toESM(require("chalk"));
 init_auth();
+init_trace();
 init_types();
 var OPERATOR_EMAILS = /* @__PURE__ */ new Set(["julienpmjacquet@gmail.com", "chkev@umich.edu"]);
 var DASHBOARD_BASE6 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
@@ -4334,53 +5044,53 @@ async function opCall(call) {
 function printResidue(report, applied) {
   const up = report?.upstash ?? {};
   const fga = report?.fga ?? {};
-  console.log(import_chalk31.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
-  console.log(import_chalk31.default.bold("\n  Upstash"));
+  console.log(import_chalk33.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk33.default.bold("\n  Upstash"));
   const orphans = up.orphans ?? [];
-  if (orphans.length === 0) console.log(import_chalk31.default.green("    no orphaned keys"));
-  for (const o of orphans) console.log(`    ${import_chalk31.default.yellow(o.key)} ${import_chalk31.default.dim(`\u2014 ${o.reason}`)}`);
-  console.log(import_chalk31.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
-  if (up.unknown?.length) console.log(import_chalk31.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
-  if (applied) console.log(`    ${import_chalk31.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
-  for (const e of up.errors ?? []) console.log(import_chalk31.default.red(`    error: ${e}`));
-  console.log(import_chalk31.default.bold("\n  OpenFGA / Neon"));
+  if (orphans.length === 0) console.log(import_chalk33.default.green("    no orphaned keys"));
+  for (const o of orphans) console.log(`    ${import_chalk33.default.yellow(o.key)} ${import_chalk33.default.dim(`\u2014 ${o.reason}`)}`);
+  console.log(import_chalk33.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (up.unknown?.length) console.log(import_chalk33.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
+  if (applied) console.log(`    ${import_chalk33.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
+  for (const e of up.errors ?? []) console.log(import_chalk33.default.red(`    error: ${e}`));
+  console.log(import_chalk33.default.bold("\n  OpenFGA / Neon"));
   if (applied) {
     const swept = fga?.swept ?? [];
-    if (swept.length === 0) console.log(import_chalk31.default.green("    no orphaned stores"));
+    if (swept.length === 0) console.log(import_chalk33.default.green("    no orphaned stores"));
     for (const s of swept) {
       console.log(
-        `    ${import_chalk31.default.yellow(s.store_id)} ${import_chalk31.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+        `    ${import_chalk33.default.yellow(s.store_id)} ${import_chalk33.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
       );
     }
-    if (fga?.remaining) console.log(import_chalk31.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    if (fga?.remaining) console.log(import_chalk33.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
-    if (fgaOrphans.length === 0) console.log(import_chalk31.default.green("    no orphaned stores"));
+    if (fgaOrphans.length === 0) console.log(import_chalk33.default.green("    no orphaned stores"));
     for (const s of fgaOrphans) {
       const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
-      console.log(`    ${import_chalk31.default.yellow(s.store_id)} ${import_chalk31.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+      console.log(`    ${import_chalk33.default.yellow(s.store_id)} ${import_chalk33.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
-    console.log(import_chalk31.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    console.log(import_chalk33.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
   }
-  for (const e of fga?.errors ?? []) console.log(import_chalk31.default.red(`    error: ${e}`));
+  for (const e of fga?.errors ?? []) console.log(import_chalk33.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}) {
   if (!loadCredentials()) {
-    console.log(import_chalk31.default.dim("Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk33.default.dim("Not logged in. Run `apiblaze login`."));
     return;
   }
   if (!isOperatorLogin()) {
-    console.log(import_chalk31.default.dim("`apiblaze op` is only available to platform operators."));
+    console.log(import_chalk33.default.dim("`apiblaze op` is only available to platform operators."));
     return;
   }
   switch (sub) {
     case void 0:
     case "menu": {
-      console.log(import_chalk31.default.bold("\nOperator menu"));
-      console.log(`  ${import_chalk31.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
-      console.log(`  ${import_chalk31.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk31.default.dim("-y to skip")})`);
-      console.log(`  ${import_chalk31.default.cyan("apiblaze op credits")}        list credit wallets
+      console.log(import_chalk33.default.bold("\nOperator menu"));
+      console.log(`  ${import_chalk33.default.cyan("apiblaze op residue")}        external-store residue report (Upstash + Neon/OpenFGA, dry-run)`);
+      console.log(`  ${import_chalk33.default.cyan("apiblaze op sweep")}          delete the orphans the report shows (asks first; ${import_chalk33.default.dim("-y to skip")})`);
+      console.log(`  ${import_chalk33.default.cyan("apiblaze op credits")}        list credit wallets
 `);
       return;
     }
@@ -4396,15 +5106,15 @@ async function runOp(sub, opts = {}) {
       const nFga = report?.fga?.orphans?.length ?? 0;
       printResidue(report, false);
       if (nUp + nFga === 0) {
-        console.log(import_chalk31.default.green("Nothing to sweep."));
+        console.log(import_chalk33.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
         const readline2 = await import("readline/promises");
         const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
-        const answer = await rl.question(import_chalk31.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s)? Type 'sweep' to confirm: `));
+        const answer = await rl.question(import_chalk33.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s)? Type 'sweep' to confirm: `));
         rl.close();
-        if (answer.trim() !== "sweep") return void console.log(import_chalk31.default.dim("Aborted."));
+        if (answer.trim() !== "sweep") return void console.log(import_chalk33.default.dim("Aborted."));
       }
       const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
       if (opts.json) return void console.log(JSON.stringify(result, null, 2));
@@ -4415,19 +5125,20 @@ async function runOp(sub, opts = {}) {
       const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list credit wallets" });
       if (opts.json) return void console.log(JSON.stringify(data, null, 2));
       const accounts = data?.accounts ?? [];
-      if (accounts.length === 0) return void console.log(import_chalk31.default.dim("No credit wallets."));
+      if (accounts.length === 0) return void console.log(import_chalk33.default.dim("No credit wallets."));
       for (const a of accounts) {
         const bal = typeof a.balance_cents === "number" ? `$${(a.balance_cents / 100).toFixed(2)}` : "?";
-        console.log(`  ${import_chalk31.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk31.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk31.default.dim(" \u2014 anon") : ""}`);
+        console.log(`  ${import_chalk33.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk33.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk33.default.dim(" \u2014 anon") : ""}`);
       }
       return;
     }
     default:
-      console.log(import_chalk31.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+      console.log(import_chalk33.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
   }
 }
 
 // src/index.ts
+init_trace();
 var program = new import_commander.Command();
 program.name("apiblaze").description("APIblaze CLI \u2014 create & manage API proxies and run dev tunnels").version(version).option("-v, --verbose", "Print the exact series of API calls each command makes (curl-equivalent you could run yourself)");
 program.hook("preAction", () => {
@@ -4478,7 +5189,7 @@ program.command("dev").description("Put your localhost behind a public URL (dev
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk32.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk34.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ port: resolved, captureFile: opts.captureFile });
@@ -4537,6 +5248,8 @@ domain.command("status").description("Check a custom domain's validation status"
 domain.command("rm").description("Remove a custom domain").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainRemove(project, opts)));
 domain.command("set-base").description("Choose which version/environment your main URL serves").argument("<project>", "Project name or id").option("--env <env>", "Environment (default: prod)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainSetBase(project, opts)));
 var tenant = program.command("tenant").description("Manage tenants \u2014 separate groups of your API's users");
+tenant.command("manage").description("Browse & edit one tenant: settings, login app clients, providers, issuers (search-first picker)").argument("[query]", "Search by tenant name/display name (omit to use your tenant scope or pick)").option("--tenant <slug>", "Exact tenant slug (skips the picker)").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantManage(query, opts)));
+tenant.command("use").description("Set the sticky tenant scope for future commands (search-first; --clear to unset)").argument("[query]", "Search by tenant name/display name").option("--clear", "Clear the tenant scope").option("--team <id|name>", "Team (defaults to active team)").action(action((query, opts) => runTenantUse(query, opts)));
 tenant.command("list").description("List tenants in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantList(opts)));
 tenant.command("create").description("Create a tenant in your team").requiredOption("--name <display>", "Display name").option("--slug <tenant_name>", "Explicit tenant slug (generated if omitted)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runTenantCreate(opts)));
 tenant.command("attach").description("Attach a tenant to a proxy").argument("<project>", "Project name or id").requiredOption("--tenant <slug>", "Tenant slug to attach").option("--auth-config <id>", "Auth config id to bind").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTenantAttach(project, opts)));
@@ -4574,7 +5287,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk32.default.bold(g.title)}
+    return `${import_chalk34.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -4602,13 +5315,13 @@ Examples:
 `);
 function printError(err) {
   if (err instanceof ApiError) {
-    console.error(import_chalk32.default.red(`
+    console.error(import_chalk34.default.red(`
 API error (${err.status}): ${err.message}`));
   } else if (err instanceof Error) {
-    console.error(import_chalk32.default.red(`
+    console.error(import_chalk34.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk32.default.red("\nUnknown error"));
+    console.error(import_chalk34.default.red("\nUnknown error"));
   }
 }
 program.parse(process.argv);